wget https://hg.mozilla.org/projects/nss/raw-file/tip/lib/ckfw/builtins/certdata.txt -P ${DOWNLOADDIR}
wget http://www.cacert.org/certs/class3.crt -P ${DOWNLOADDIR}
wget http://www.cacert.org/certs/root.crt -P ${DOWNLOADDIR}
tar xf ${DOWNLOADDIR}/make-ca-1.16.1.tar.gz -C ${BUILDDIR}
pushd ${BUILDDIR}/make-ca-1.16.1
	make DESTDIR=${SYSDIR}/sysroot install
	install -vdm755 ${SYSDIR}/sysroot/etc/ssl/local
	cp ${SYSDIR}/sysroot/usr/sbin/make-ca ${SYSDIR}/cross-tools/bin/
	sed -i "/MAKE_CA_CONF/s@\"/etc@\"${SYSDIR}/sysroot/etc@g" ${SYSDIR}/cross-tools/bin/make-ca
	cp ${DOWNLOADDIR}/certdata.txt ./
	cp ${DOWNLOADDIR}/root.crt ./
	cp ${DOWNLOADDIR}/class3.crt ./
	${SYSDIR}/cross-tools/bin/make-ca --destdir ${SYSDIR}/sysroot -C certdata.txt
	openssl x509 -in root.crt -text -fingerprint -setalias "CAcert Class 1 root" \
		-addtrust serverAuth -addtrust emailProtection -addtrust codeSigning \
		> ${SYSDIR}/sysroot/etc/ssl/local/CAcert_Class_1_root.pem
	openssl x509 -in class3.crt -text -fingerprint -setalias "CAcert Class 3 root" \
		-addtrust serverAuth -addtrust emailProtection -addtrust codeSigning \
		> ${SYSDIR}/sysroot/etc/ssl/local/CAcert_Class_3_root.pem
	${SYSDIR}/cross-tools/bin/make-ca --destdir ${SYSDIR}/sysroot -r
popd

mkdir -pv ${SYSDIR}/sysroot/etc/profile.d &&
cat > ${SYSDIR}/sysroot/etc/profile.d/pythoncerts.sh << "EOF"
## Begin /etc/profile.d/pythoncerts.sh

export _PIP_STANDALONE_CERT=/etc/pki/tls/certs/ca-bundle.crt

## End /etc/profile.d/pythoncerts.sh
EOF
